RouterOS Manager · infrastructure
Your MikroTik router, watched and witnessed.
Health, DHCP, firewall and WireGuard state from your RouterOS device, read through QuoxCORE. Actions that change the router wait for a human yes, and every operation is witnessed on the same evidence chain as the rest of your agents.
In plain words
What it is, where it lives, when to reach for it
- What is it
- A plugin for the QuoxCORE dashboard that watches and manages the MikroTik RouterOS device your network runs on.
- Where do I use it
- On the RouterOS panels in your dashboard, connected to your router through the RouterOS REST API.
- When would I use it
- When you need router health, DHCP leases, firewall state or WireGuard peers without opening WinBox or a terminal.
- How do I use it
- Buy it once in the store for $35, then an org admin installs it with
quox plugin install.
QuoxCORE is the free, self-hosted platform underneath this. What is QuoxCORE
What it does
One router, nothing guessed.
RouterOS Manager talks to your MikroTik device over the RouterOS REST API and through the mikrotik entity tools carried by QuoxBastion and quoxagent. Reads are free and constant: health, leases, peers, inventory. Writes are rarer and heavier, so each one is gated behind a human approval and lands as a witnessed record, not a mystery.
- Read-only device data on tap. Health, DHCP leases, pool usage, WireGuard peers and the discovery inventory, without opening WinBox.
- Safety-gated actions. Blocking an address or reserving a lease holds in your inbox until a human approves it.
- Witnessed by default. Every operation is wrapped in an AEE envelope and witnessed on the WARD chain.
- Plain English alerts. Two devices fighting over the same address is reported in exactly those words.
{
"tool": "mikrotik_dhcp_conflict_check",
"router": "hEX S · RouterOS 7.16",
"finding": "192.0.2.14 claimed twice",
"offenders": ["printer-2f", "cam-hall"],
"witnessed": true
}Where it honestly stands
Proven live. And not finished.
On 7 August 2026 this plugin was driven end to end against a real MikroTik router. What passed that day is listed on the left, and it is what you get today. The right column is declared but not yet wired: those tools answer with an honest 501 instead of pretending, and they are on the roadmap.
Live today, proven 2026-08-07
- Router health check. CPU, memory, temperature, uptime and board identity in one governed read, straight off the RouterOS REST API.
- DHCP management. Leases listed, one-click reservations, pool usage and an address-conflict check that names both offenders.
- Firewall block. Block an address through the mikrotik entity tools. The change is HITL-gated and lands witnessed, like every write.
- WireGuard peers and health. Every peer with its handshake age, so a dead tunnel is a glance rather than an investigation.
- Discovery inventory. What the router already knows about the network around it, read back as a device inventory.
Declared, not yet wired
9 of the 18 signature RouterOS tools return a 501 today rather than a fake answer. Chat-based troubleshooting through the NETWATCH agent is part of the same gap: asking it about your router in chat does not work yet. The dashboard panels carry the live data instead.
- Discovery scan
- Interface monitoring
- Traffic monitoring
- Firewall rules list
- Unblock IP
- Issue analysis
- Ping diagnostics
- DNS diagnostics
- Automation preview
Governed, like everything on Quox
What happens when you say block.
A tool that can change firewall state has to answer to something. This one answers to the same governance layer as your agents. Follow one sharp action through it.
You ask for a block, a reservation, a change.
Plain English in, a concrete RouterOS operation out. Nothing has touched your router yet.
The action waits in your inbox.
Writes are HITL-gated: they hold until a human says yes. Reading health, leases or peers never needs approval; changing the router always does.
Approved, executed, enveloped.
Every operation is wrapped in an AEE envelope, so cause and effect stay traceable through the activity feed.
Witnessed on WARD.
The operation lands in the platform audit pipeline and is witnessed on the WARD chain, the same tamper-evident record your auditors verify.
Pricing
One payment, yours to keep.
RouterOS Manager
Pay once and the RouterOS panels are part of your QuoxCORE install for good. It switches on with a licence key pasted in Settings, and needs a MikroTik router running RouterOS 7.x with the REST API reachable.
- Router health, DHCP, firewall and WireGuard panels
- HITL approval on every router-changing action
- AEE envelopes and WARD witness on every operation
- Honest 501 on the tools that are not wired yet